Listen to this Post
The vulnerability exists in the `intel-thc` kernel driver within the `thc_i2c_subip_regs_save()` function. The code incorrectly uses a secondary pointer (&dev->i2c_subip_regs) when performing a bulk read operation via regmap_bulk_read(). This pointer arithmetic error causes the function to calculate a target address outside the bounds of the allocated `i2c_subip_regs` buffer, which is a fixed-size array of 192 bytes. When the kernel attempts to write data to this miscalculated out-of-bounds address, it triggers a KASAN slab-out-of-bounds error, leading to a kernel crash or system instability. The fix replaces the faulty pointer arithmetic with direct array indexing (&dev->i2c_subip_regs
</code>), ensuring all memory accesses stay within the allocated region. Platform: Linux Kernel Version: 6.16.0+ Vulnerability: Pointer Arithmetic Severity: Medium date: 09/16/2025 <h2 style="color: blue;">Prediction: Patch 09/09/2025</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] grep -r "intel-thc" /usr/src/linux/ sudo dmesg | grep -i "kasan|thc" modprobe intel-thc-hid
// Buggy code snippet (conceptual) regmap_bulk_read(..., &dev->i2c_subip_regs, ...); // Fixed code regmap_bulk_read(..., &dev->i2c_subip_regs[bash], ...);
Exploit:
Kernel crash denial-of-service.
Protection from this CVE
Update Linux kernel.
Impact:
System crash.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
